CVE-2026-41205

High

Published: 23/04/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal when a URI starts with //. This can lead to any file readable by the process being returned as rendered template content.

Risk Assessment

Organizations may be exposed to the disclosure of sensitive data if applications pass untrusted input directly to TemplateLookup.get_template().

Recommendation

It is recommended to upgrade the Mako library to version 1.3.11 or later to mitigate this vulnerability.

Other vulnerabilities in Mako

CVE-2026-44307High
Mako is a template library written in Python. Prior to 1.3.12, on Windows, a URI using backslash traversal (e.g. \..\..\ secret.txt) bypassed the directory traversal check in Template.__init__ and the posixpath-based normalization in TemplateLookup.get_template(), allowing reads of files outside the configured template directory.

Original NVD description (English source)

Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal when a URI starts with // (e.g., //../../../secret.txt). The root cause is an inconsistency between two slash-stripping implementations. Any file readable by the process can be returned as rendered template content when an application passes untrusted input directly to TemplateLookup.get_template(). This vulnerability is fixed in 1.3.11.